18/Oct/2019
A cybersecurity breach at TransUnion Canada, a division of the credit monitoring agency, has underscored the rising threat of third-party attacks and the difficulty of preventing them.
The company confirmed that the personal data of 37,000 Canadians was compromised when someone illegally used a legitimate business customer’s login to access TransUnion data.
The data at TransUnion was compromised between June 28 and July 11, but the incident wasn’t detected until August.
In a letter sent out to affected consumers, TransUnion said the compromised information could include a person’s name, date of birth, current and former address, information on credit and loan obligations, and credit repayment history. It said the data wouldn’t have included any account numbers, but would have shown a social insurance number if the number was used while accessing the file.
In a statement TransUnion said that the unauthorised access was “not the result of a breach or failure of TransUnion’s systems”. In its latest corporate responsibility report TransUnion said that it has a third-party risk management programme in place, which sets out guidelines that must be met by its partners on a range of risks including strategic, financial, and information security risk.
Canadian Western Bank, parent company of the CWB National Leasing division whose login information was used in the attack, said it has been unable to determine how the login credentials were illegally acquired.
The incident is the latest of numerous data breaches in recent years, including the Equifax breach in 2017 which exposed the information of 147 million people, including about 19,000 Canadians. More recently, in July Capital One said that the data of six million Canadians was hacked, including about a million social insurance numbers. Desjardins said in June that the data of about 2.7 million accounts were hit with a breach.
For more on this story, take a look at this Bloomberg article.
